Cybersecurity Platform Engineer - MCO Detection and Response

Location: Geneva · Contract: Permanent · Assignment: long term · Rate: 100% · Start: January 2027

For one of our clients based in Geneva, we are looking for a Cybersecurity Platform Engineer - MCO Detection and Response to strengthen their operational cybersecurity capabilities.

Context

The IT security monitoring and coordination team wishes to have a dedicated skill to ensure the availability, reliability and efficiency of the tools and processes used by the cybersecurity team to detect, analyse and respond to incidents.

This role is part of the evolution of the operational security system. It aims in particular to ensure that technical security capabilities are available, correctly configured, interconnected, performant, maintained and scalable, so that security teams can effectively carry out their operational missions.

You work on the technical chains associated with detection and response, without replacing the analysts responsible for incident investigation. You are the technical reference point for security platforms and processing chains that transform technical data into operational detection and response capabilities.

Your missions

• Ensure the continuous operation of data, tools and technical chains necessary to respond to attacks and incidents

• Guarantee the availability, reliability, performance, security and operational efficiency of technical detection, analysis and response capabilities

• Automate deployments and configuration checks, and implement testing procedures before production deployment

• Manage the lifecycle and obsolescence of components

• Identify technical anomalies that may degrade detection capability: loss or delay of telemetry, parsing errors, saturation, connector failure, malfunction of a rule or integration

• Plan, test and deploy software updates and security patches for tools (detection signatures, SIEM rules, etc.)

• Keep technical documentation up to date (configurations, procedures, architecture diagrams)

• Supervise detection tools (SIEM, EDR, etc.) and their integrations to anticipate failures or degradations

• Analyse root causes (RCA) of failures to prevent recurrence

• Produce regular reports on the status of tools (availability, performance, incidents)

• Present key metrics (mean time to resolution, number of false positives, etc.)

Education

• University Master’s degree in computer science, EPF engineering diploma or equivalent

Essential skills

• Proven experience in administration and production operation of complex cybersecurity/SOC platforms

• Extensive experience in administration and operation of at least one major SIEM platform and good understanding of SIEM, EDR/XDR, SOAR architectures and log collection

• Operational mastery of Splunk and SPL

• Ability to build technical dashboards and indicators of availability, performance and quality of service

• Mastery of security event collection and processing architectures: agents, collectors, APIs, Syslog, parsing, normalisation, enrichment, routing, ingestion and storage

• Ability to diagnose telemetry losses, delays, duplications or anomalies and ensure completeness and quality of data used by the SOC

• Ability to automate operational, control and deployment tasks using a scripting language

Desirable skills

• Knowledge of high availability architectures, backup and restore mechanisms and continuity and recovery principles applicable to security platforms

• Monitoring capacity, performance, volume and technical thresholds of platforms

• Experience with Git or an equivalent version control tool

• Knowledge of detection technologies and mechanisms: correlation, analytics, UEBA, behavioural detection

• Knowledge of Microsoft Azure, Entra ID and M365

A plus

• PowerShell scripting

• Python scripting

Personal qualities

• Rigor and analytical mindset

• Ability to quickly diagnose technical issues

• Structured problem diagnosis and resolution skills

• Passion for automation and continuous improvement

• Sense of service and operational responsibility

• Ability to document and communicate with technical and operational teams